2026-07-17 归档

今日共收录 1302 条安全情报，包含 372 个 CVE，507 篇安全通告，以及 120 篇研究论文。

漏洞预警2026-07-16 发布INFO

A potential vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code ...

CVE-2026-13104

A potential vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could al

历史摘要 · 未重新核验 · NVD

#cve #cwe-250

漏洞预警2026-07-16 发布INFO

A potential path traversal vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute ...

CVE-2026-13103

A potential path traversal vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-16 发布INFO

A potential missing authentication vulnerability could allow a local privileged attacker to use WMI commands to arbitrarily trigger a System Management Interrupt handler.

CVE-2026-10590

A potential missing authentication vulnerability could allow a local privileged attacker to use WMI commands to arbitrar

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-16 发布INFO

A potential out of bounds write vulnerability could allow a local privileged attacker to execute code in System Management Mode.

CVE-2026-10589

A potential out of bounds write vulnerability could allow a local privileged attacker to execute code in System Manageme

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-07-16 发布INFO

A potential vulnerability could allow a local privileged attacker to disclose the address of protected System Management Mode memory.

CVE-2026-10588

A potential vulnerability could allow a local privileged attacker to disclose the address of protected System Management

历史摘要 · 未重新核验 · NVD

#cve #cwe-497

漏洞预警2026-07-16 发布INFO

A potential out-of-bounds write vulnerability could allow a local privileged attacker to modify power management settings in System Management Mode.

CVE-2026-10587

A potential out-of-bounds write vulnerability could allow a local privileged attacker to modify power management setting

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-07-16 发布INFO

LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to Local File Inclusion (LFI) in the OnlyOfficeEditor servlet class, allowing authenticated user to exploit path travers...

CVE-2025-45870

LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to Local File Inclusion (LFI) in the OnlyOfficeEditor servlet c

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-16 发布INFO

Perfect Support Ticketing & Document Management System through 1.7 contains a broken access control vulnerability that allows authenticated attackers with Agent-level privileges...

CVE-2026-63082

Perfect Support Ticketing & Document Management System through 1.7 contains a broken access control vulnerability that a

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-16 发布INFO

Perfect Support Ticketing & Document Management System through 1.7 contains a stored cross-site scripting vulnerability that allows authenticated attackers with Agent-level priv...

CVE-2026-63081

Perfect Support Ticketing & Document Management System through 1.7 contains a stored cross-site scripting vulnerability

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-16 发布INFO

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote http(s) URLs and reading local absolute or out-of-tr...

CVE-2026-59867

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota resolved OpenAPI $ref values by fetching re

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-829 #cwe-918

漏洞预警2026-07-16 发布INFO

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without identifier or path sa...

CVE-2026-59866

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-94

漏洞预警2026-07-16 发布INFO

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, `kiota info` read x-ms-kiota-info.languagesInformation.<language>.dependencyInstallCommand plus dependency...

CVE-2026-59865

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, `kiota info` read x-ms-kiota-info.languagesInform

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-829

漏洞预警2026-07-16 发布INFO

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, `kiota plugin add` and `kiota plugin generate` (with `-t APIPlugin`) emitted attacker-controlled static_te...

CVE-2026-59864

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, `kiota plugin add` and `kiota plugin generate` (w

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-829

漏洞预警2026-07-16 发布INFO

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.206, several plugin validation routes in...

CVE-2026-57206

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions

历史摘要 · 未重新核验 · NVD

#cve #cwe-306 #cwe-862

漏洞预警2026-07-16 发布INFO

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.203, the authenticated GET /api/user/inf...

CVE-2026-57205

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-639 #cwe-862

漏洞预警2026-07-16 发布INFO

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.7, the COMMAND_RESULTS handler in ufo/server/ws/handler.py called get_o...

CVE-2026-55440

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.7, the COMMAND

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-862

漏洞预警2026-07-16 发布INFO

The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration for Moodle. Prior to 4.5.6, 5.0.5, and 5.1.1, the Microsoft...

CVE-2026-54733

The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration fo

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-07-16 发布INFO

Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a client connected to the UFO WebSocket server as a DEVICE c...

CVE-2026-54568

Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a c

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-07-16 发布INFO

Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders expanded ${file:...} references in .prompty frontmatter without enforcing th...

CVE-2026-53598

Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders expanded ${file:...

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-200

漏洞预警2026-07-16 发布INFO

Prompty is a markdown file format (.prompty) for LLM prompts. From 2.0.0-alpha.1 until 2.0.0-beta.3, the @prompty/core TypeScript loader in runtime/typescript/packages/core/src/...

CVE-2026-53597

Prompty is a markdown file format (.prompty) for LLM prompts. From 2.0.0-alpha.1 until 2.0.0-beta.3, the @prompty/core T

历史摘要 · 未重新核验 · NVD

#cve #cwe-94